[TRACKING] Complete support for CycloneDX v1.4

see https://github.com/CycloneDX/specification/releases/tag/1.4

The following items are not currently supported for CycloneDX v1.4 (as of release 6.4.x):

- [ ] Missing `compositions` on `Bom`
see via #607
- [ ] Missing `properties` on `Bom`
- see #125
- [ ] Support in v1.4
- [x] Support in v1.5+ via #585
- [ ] `$.components[].signature`
- issue: #978
- [ ] JSF signatures
- to be continues

-----

this library is a community effort.
if you find a feature that you need is missing, feel free to donate/contribute the missing feature.
- see #633